{"id":"CVE-2018-15685","details":"GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and \"nativeWindowOpen: true\" or \"sandbox: true\" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.","aliases":["GHSA-hv9c-qwqg-qj3v"],"modified":"2026-08-07T11:31:05.893813702Z","published":"2018-08-23T05:29:00.227Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:electronjs:electron:3.0.0:beta6:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0-beta6"},{"last_affected":"3.0.0-beta6"}],"source":"CPE_STRING","vendor_product":"electronjs:electron"}]},"references":[{"type":"ADVISORY","url":"https://electronjs.org/blog/web-preferences-fix"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/45272/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/electron/electron","events":[{"introduced":"9c466846edb243dc56899e62d04b0af46d88dc77"},{"last_affected":"5f372f7ecccffb11ba76bcebe4f6b233d7548388"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:electronjs:electron:1.7.15:*:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:1.8.7:*:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:2.0.7:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.7.15"},{"last_affected":"1.7.15"},{"introduced":"1.8.7"},{"last_affected":"1.8.7"},{"introduced":"2.0.7"},{"last_affected":"2.0.7"}]}}],"versions":["1.7.15","1.8.7","2.0.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15685.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}